From patchwork Mon Jun 1 07:27:34 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Alan Modra X-Patchwork-Id: 136151 Return-Path: X-Original-To: patchwork@sourceware.org Delivered-To: patchwork@sourceware.org Received: from vm01.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id E90CB4BA2E29 for ; Mon, 1 Jun 2026 07:28:14 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org E90CB4BA2E29 Authentication-Results: sourceware.org; dkim=pass (2048-bit key, unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20251104 header.b=YmST/f+T X-Original-To: binutils@sourceware.org Delivered-To: binutils@sourceware.org Received: from mail-pl1-x62c.google.com (mail-pl1-x62c.google.com [IPv6:2607:f8b0:4864:20::62c]) by sourceware.org (Postfix) with ESMTPS id 6B5474BA2E0D for ; Mon, 1 Jun 2026 07:27:39 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 6B5474BA2E0D Authentication-Results: sourceware.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=gmail.com ARC-Filter: OpenARC Filter v1.0.0 sourceware.org 6B5474BA2E0D Authentication-Results: sourceware.org; arc=none smtp.remote-ip=2607:f8b0:4864:20::62c ARC-Seal: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1780298859; cv=none; b=lf7Ra0ikncfWq5nxIgbbr3qpHXxyWwO+QljWGoRz58LuTfy9rsFo3EmbYBIor/ZqlMI32qnaDm12HbUrDQHgXbAUx3ofdhe0HCqhecKZ1QxHfDaVXSK+tHD1qsjLPCArJ6sOF4J4ltTtq2tOSEYOot9BFq8j9l/G8MaKV7ad6Zs= ARC-Message-Signature: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1780298859; c=relaxed/simple; bh=SSKawUumJEd75WaUTffcAJahHUB2d8+z/RgFbUIeWFU=; h=DKIM-Signature:Date:From:To:Subject:Message-ID:MIME-Version; b=bmP663H3DrerdC+UQh0aWemSRoF3uRZsZLs1aytthnIh8pa3vGKQAD1y8id9mqjVukl4i8+2PZYMTxYV0vVmQuQSpOk9a3Hn1dbj/6e9z7d97S+L665FF/1X1nu8e4ySoYt7a6ahDbM3U/LOD4MQjQA66U4ullTymve0jV9lqVA= ARC-Authentication-Results: i=1; sourceware.org; dkim=pass (2048-bit key, unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20251104 header.b=YmST/f+T DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 6B5474BA2E0D Received: by mail-pl1-x62c.google.com with SMTP id d9443c01a7336-2c0b9328c4aso8295335ad.0 for ; Mon, 01 Jun 2026 00:27:39 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1780298858; x=1780903658; darn=sourceware.org; h=content-disposition:mime-version:message-id:subject:to:from:date :from:to:cc:subject:date:message-id:reply-to; bh=Ty2EbQPwh5oUWhYN7iHwzlsLw39+ChZdhbuJktbkkqA=; b=YmST/f+T5o1CHtsYS7vQ9Z6uOkHWcJRtjxJ13LBL34oH+/a+afrJjohmeuo9aeHYkA GIpaU7Q3QMU5ZEr7zaPQEcizNN1XTWr/CGdpblQvxZyUILGpe6uw391uDr6HNaWYjqCQ /TK8xnU8HR9Jrcj0fNftwHo5ym0tLU69ZvdKNwgbgfmYvOnttOloMbJgAhSHUpXL2eOj +QjuFl5M/ZuH7g/kqtaMir1/FT5b6QkvUdZ5sFNU3X4kZCMvLCMMewalZnOgVtmmG3bY AZKPfSiBdIB3gatS+1lvtNjtYwN/WKYbFPZfGrV24jEzY2jJyXYBkZp/Wq08VB3nWrR1 200A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1780298858; x=1780903658; h=content-disposition:mime-version:message-id:subject:to:from:date :x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=Ty2EbQPwh5oUWhYN7iHwzlsLw39+ChZdhbuJktbkkqA=; b=Gp6OvlGZma2I3KdQC//bVexK+tVGmKxNN3OgZRZKE0XEKOP5HoIXhtne06XHMRd60G ougN+tburKeibHJl4wboo9cUiEuxdXpSSWn3QiPk8EDdYgRPlztDjHBIzp8smYhEiRml iK751+rGtf/+vr1Q/jWdAKGcq75dfKHo2m2TD17A0aNshAe6mMltxOB6EuNZn/2MjKH5 pk9hC9U7s+XS3ikdoJ778l4Yw7bam4LDTMwh0n7n1vz4HClzF+WxX6Ts1/XxAAXpSIby vzHBk1/+9wFcyi7e6pLrKUymQ7Pp1wxVUU+FdQMhCFLfq7qPvReuv2JuDlAOfIA9LHRr pxSA== X-Gm-Message-State: AOJu0Yw0M/jsy6iV+tLAJxudOUQ9J6tVNMCwLv11z82qfi0cQDYWLSig /Sh1tc7ge9ap18ur3U5eVG6CkGrfnu7Qjf8PGIxaMCDHB9+/lPe0ZihDQgLITQ== X-Gm-Gg: Acq92OGKYQ2CAqc0YVHIDm/WOHwyRMEKSCHQO0hW+6xSbPy3IgXOu7jc7NxmEykwd0C awUvcEiY3QIkJBsG9xFQ+Gy6UTXeU4GL8Be3/z6cGv0xrwaxPkWF30S0g0ZG2N4VpzG/x8YUat2 2T5IeVtKb92iwoJZ4bZbqVN1IOrNsCI3SOiD4jrGgpcE/cMPKbYAA4PYDpyBwAVf1/zVTJj3F+d fFN4CpUVcZ5ou4uRRJkHEfbdoc43OR1VfCTBu2JH5XYF4+otvgrz9M8itpKw3u0tzrwB71tLN6p 6PxT79KZephT1fHlRilRYMIq4ZCepru4UPLlOMUe0dVj9DMsPb/sYGfAo+W8IiwbIB4vE9PFa50 bgD2rYgIv5eR7abigqk0PxVL8D6ePEJIgG9FtlTk9pejTVI5cDIj8GqcYFqXoceRrX+5l557YT7 ATvLpYQiYGpbUaSwIEX8lShOuW/Rlx/WBt8O/mtT5o4i4= X-Received: by 2002:a17:902:cf10:b0:2c0:f807:9bf3 with SMTP id d9443c01a7336-2c0f807a2a6mr6994475ad.10.1780298858220; Mon, 01 Jun 2026 00:27:38 -0700 (PDT) Received: from squeak.grove.modra.org ([58.96.106.158]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2bf23b00ebcsm96226595ad.51.2026.06.01.00.27.37 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 01 Jun 2026 00:27:37 -0700 (PDT) Received: by squeak.grove.modra.org (Postfix, from userid 1000) id E143F1141A1E; Mon, 01 Jun 2026 16:57:34 +0930 (ACST) Date: Mon, 1 Jun 2026 16:57:34 +0930 From: Alan Modra To: binutils@sourceware.org Subject: buffer overflow in parse_stab_array_type Message-ID: MIME-Version: 1.0 Content-Disposition: inline X-Spam-Status: No, score=-3030.0 required=5.0 tests=BAYES_00, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, FREEMAIL_FROM, GIT_PATCH_0, RCVD_IN_DNSWL_BLOCKED, SPF_HELO_NONE, SPF_PASS, TXREP shortcircuit=no autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on sourceware.org X-BeenThere: binutils@sourceware.org X-Mailman-Version: 2.1.30 Precedence: list List-Id: Binutils mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: binutils-bounces~patchwork=sourceware.org@sourceware.org Fix oss-fuzz induced damage. stabs.c (parse_stab_type): Don't access beyond end of stab with bad type. (parse_stab_array_type): Don't duplicate "bad stab" message. diff --git a/binutils/stabs.c b/binutils/stabs.c index 81068a4bf7c..27d49376b97 100644 --- a/binutils/stabs.c +++ b/binutils/stabs.c @@ -1293,6 +1293,12 @@ parse_stab_type (void * dhandle, } } + if (*pp >= p_end) + { + bad_stab (orig); + return DEBUG_TYPE_NULL; + } + descriptor = **pp; ++*pp; @@ -3219,11 +3225,7 @@ parse_stab_array_type (void *dhandle, { index_type = debug_find_named_type (dhandle, "int"); if (index_type == DEBUG_TYPE_NULL) - { - index_type = debug_make_int_type (dhandle, 4, false); - if (index_type == DEBUG_TYPE_NULL) - return DEBUG_TYPE_NULL; - } + index_type = debug_make_int_type (dhandle, 4, false); *pp = p; } else @@ -3231,6 +3233,8 @@ parse_stab_array_type (void *dhandle, index_type = parse_stab_type (dhandle, info, (const char *) NULL, pp, (debug_type **) NULL, p_end); } + if (index_type == DEBUG_TYPE_NULL) + return DEBUG_TYPE_NULL; if (**pp != ';') {